{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:S436TOEUYUG7T7J2EU5E36CY5S","short_pith_number":"pith:S436TOEU","canonical_record":{"source":{"id":"2606.28923","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2026-06-27T13:56:56Z","cross_cats_sorted":[],"title_canon_sha256":"21131ea9f7dc971153c4d6d50cbeb9cb2f147812e0b3fb20cc6ca8a07df0b010","abstract_canon_sha256":"0622a4a72e63b4c5838eed28466c82ed66991c064c00e69665312fc1b0ceefcf"},"schema_version":"1.0"},"canonical_sha256":"9737e9b894c50df9fd3a253a4df858ec8d49be0cd3a2b2ddaa666be8baac6c8d","source":{"kind":"arxiv","id":"2606.28923","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.28923","created_at":"2026-06-30T01:17:45Z"},{"alias_kind":"arxiv_version","alias_value":"2606.28923v1","created_at":"2026-06-30T01:17:45Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.28923","created_at":"2026-06-30T01:17:45Z"},{"alias_kind":"pith_short_12","alias_value":"S436TOEUYUG7","created_at":"2026-06-30T01:17:45Z"},{"alias_kind":"pith_short_16","alias_value":"S436TOEUYUG7T7J2","created_at":"2026-06-30T01:17:45Z"},{"alias_kind":"pith_short_8","alias_value":"S436TOEU","created_at":"2026-06-30T01:17:45Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:S436TOEUYUG7T7J2EU5E36CY5S","target":"record","payload":{"canonical_record":{"source":{"id":"2606.28923","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2026-06-27T13:56:56Z","cross_cats_sorted":[],"title_canon_sha256":"21131ea9f7dc971153c4d6d50cbeb9cb2f147812e0b3fb20cc6ca8a07df0b010","abstract_canon_sha256":"0622a4a72e63b4c5838eed28466c82ed66991c064c00e69665312fc1b0ceefcf"},"schema_version":"1.0"},"canonical_sha256":"9737e9b894c50df9fd3a253a4df858ec8d49be0cd3a2b2ddaa666be8baac6c8d","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-06-30T01:17:45.542527Z","signature_b64":"Vrm39MOGf2/XTlHF1FMML0DKGqPxqYZXYDFzpJDJtv5T/kRUPrdmrl0c00EcIQrO/MdN0RrrLzX4omGcx+/nAw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"9737e9b894c50df9fd3a253a4df858ec8d49be0cd3a2b2ddaa666be8baac6c8d","last_reissued_at":"2026-06-30T01:17:45.541872Z","signature_status":"signed_v1","first_computed_at":"2026-06-30T01:17:45.541872Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2606.28923","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-30T01:17:45Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Q1O54TYJgHDUPa/pCxVfmD1ZIT0yOx81tM7ZxJUakt3JG3VG5APU0YAaY1KspD3c4pyePIYN1e/5OVsM4IoOBQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-01T00:10:19.039188Z"},"content_sha256":"1a650b9001122a77a68ed77e3a28081a5f027f34811663aecf06461aa4dc8af6","schema_version":"1.0","event_id":"sha256:1a650b9001122a77a68ed77e3a28081a5f027f34811663aecf06461aa4dc8af6"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:S436TOEUYUG7T7J2EU5E36CY5S","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Towards Improved Anomaly Detection for Cloud Cybersecurity via Graph Neural Networks","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.LG","authors_text":"Edward Raff, Manu Nandan, Michael Brautbar, TJ Jaymes","submitted_at":"2026-06-27T13:56:56Z","abstract_excerpt":"Detecting security threats in an organization's cloud computing environment has become necessary due to the increased reliance on cloud infrastructure. Logging of all cloud computing events enables investigation into any incidents after they are detected. Automated detection of threats using the logs based on heuristics or anomaly detection could result in a high false positive rate due to its relatively static nature. In this article, we present an industrial case study of a self-supervised learning method using graph neural networks applied to AWS CloudTrail logs to surface suspicious events"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.28923","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2606.28923/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-30T01:17:45Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"jqYd7MFdeLheKERdVyvICfRYh6u055FAAUeXwv0NRjcMvsek0WLw0TnTVmyHMA2ysq1d5Q/kYtIlVHJSnf/qCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-01T00:10:19.039577Z"},"content_sha256":"519d20f5cdecce8e2297eecaa5ff81afbaf3d26138cc118c32a471812e31b2d9","schema_version":"1.0","event_id":"sha256:519d20f5cdecce8e2297eecaa5ff81afbaf3d26138cc118c32a471812e31b2d9"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/S436TOEUYUG7T7J2EU5E36CY5S/bundle.json","state_url":"https://pith.science/pith/S436TOEUYUG7T7J2EU5E36CY5S/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/S436TOEUYUG7T7J2EU5E36CY5S/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-01T00:10:19Z","links":{"resolver":"https://pith.science/pith/S436TOEUYUG7T7J2EU5E36CY5S","bundle":"https://pith.science/pith/S436TOEUYUG7T7J2EU5E36CY5S/bundle.json","state":"https://pith.science/pith/S436TOEUYUG7T7J2EU5E36CY5S/state.json","well_known_bundle":"https://pith.science/.well-known/pith/S436TOEUYUG7T7J2EU5E36CY5S/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:S436TOEUYUG7T7J2EU5E36CY5S","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"0622a4a72e63b4c5838eed28466c82ed66991c064c00e69665312fc1b0ceefcf","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2026-06-27T13:56:56Z","title_canon_sha256":"21131ea9f7dc971153c4d6d50cbeb9cb2f147812e0b3fb20cc6ca8a07df0b010"},"schema_version":"1.0","source":{"id":"2606.28923","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.28923","created_at":"2026-06-30T01:17:45Z"},{"alias_kind":"arxiv_version","alias_value":"2606.28923v1","created_at":"2026-06-30T01:17:45Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.28923","created_at":"2026-06-30T01:17:45Z"},{"alias_kind":"pith_short_12","alias_value":"S436TOEUYUG7","created_at":"2026-06-30T01:17:45Z"},{"alias_kind":"pith_short_16","alias_value":"S436TOEUYUG7T7J2","created_at":"2026-06-30T01:17:45Z"},{"alias_kind":"pith_short_8","alias_value":"S436TOEU","created_at":"2026-06-30T01:17:45Z"}],"graph_snapshots":[{"event_id":"sha256:519d20f5cdecce8e2297eecaa5ff81afbaf3d26138cc118c32a471812e31b2d9","target":"graph","created_at":"2026-06-30T01:17:45Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2606.28923/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Detecting security threats in an organization's cloud computing environment has become necessary due to the increased reliance on cloud infrastructure. Logging of all cloud computing events enables investigation into any incidents after they are detected. Automated detection of threats using the logs based on heuristics or anomaly detection could result in a high false positive rate due to its relatively static nature. In this article, we present an industrial case study of a self-supervised learning method using graph neural networks applied to AWS CloudTrail logs to surface suspicious events","authors_text":"Edward Raff, Manu Nandan, Michael Brautbar, TJ Jaymes","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2026-06-27T13:56:56Z","title":"Towards Improved Anomaly Detection for Cloud Cybersecurity via Graph Neural Networks"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.28923","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:1a650b9001122a77a68ed77e3a28081a5f027f34811663aecf06461aa4dc8af6","target":"record","created_at":"2026-06-30T01:17:45Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"0622a4a72e63b4c5838eed28466c82ed66991c064c00e69665312fc1b0ceefcf","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2026-06-27T13:56:56Z","title_canon_sha256":"21131ea9f7dc971153c4d6d50cbeb9cb2f147812e0b3fb20cc6ca8a07df0b010"},"schema_version":"1.0","source":{"id":"2606.28923","kind":"arxiv","version":1}},"canonical_sha256":"9737e9b894c50df9fd3a253a4df858ec8d49be0cd3a2b2ddaa666be8baac6c8d","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"9737e9b894c50df9fd3a253a4df858ec8d49be0cd3a2b2ddaa666be8baac6c8d","first_computed_at":"2026-06-30T01:17:45.541872Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-06-30T01:17:45.541872Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"Vrm39MOGf2/XTlHF1FMML0DKGqPxqYZXYDFzpJDJtv5T/kRUPrdmrl0c00EcIQrO/MdN0RrrLzX4omGcx+/nAw==","signature_status":"signed_v1","signed_at":"2026-06-30T01:17:45.542527Z","signed_message":"canonical_sha256_bytes"},"source_id":"2606.28923","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:1a650b9001122a77a68ed77e3a28081a5f027f34811663aecf06461aa4dc8af6","sha256:519d20f5cdecce8e2297eecaa5ff81afbaf3d26138cc118c32a471812e31b2d9"],"state_sha256":"6ca1e9e1db055320b05832c72a3bc664fa43623dc1a6d19d915fc556892bdf18"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"9f0Ergy5ZzQgrM4eOsmTn9YAEfBiUaCFndkx6CxqDPV+01clv87tNx+g3DTHH6JI7K2n9+N03Izu+XJTKgv8Ag==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-01T00:10:19.042252Z","bundle_sha256":"033a99576bcffc314be3062129c37fe46826d9d9a12b98b9b110392b59afa318"}}